REDHAT-BUG-2572591: Null Pointer Dereference
A flaw was found in SSSD. The jsonunpackoauth2code() function in src/responder/pam/pamsrvjson.c fails to validate that the OAuth2 JSON code field has string type. A present non-string value causes jsonstringvalue() to return NULL. The function can return success with a NULL output, after which jsonunpackauthreply() evaluates strlen(oauth2code), causing a NULL pointer dereference and terminating sssdpam. A local user able to connect to the PAM responder socket can provide crafted JSON authentication information and selection items before authentication. The affected code is conditional on HAVEGDMCUSTOMJSONPAMEXTENSION. The maintainer confirmed that the extension is enabled beginning with RHEL 9.8 and RHEL 10.2, and that the incoming selection data is not sanitized at the socket boundary. Exact affected builds and backports still require product assessment. Source report: PSIRTSUPT-25890, finding H-08. Related earlier record: OSIM-80264 / 559edf59-4ee2-49f9-95cd-d5d36b419a81; it was automatically rejected because no CVE was assigned, rather than on a technical invalidity determination.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the crash?
A local user who can connect to the PAM responder socket can send crafted JSON authentication information and selection items before authentication. The result is termination of sssd_pam through a NULL pointer dereference.
Which configurations are exposed?
The vulnerable code is compiled only when HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION is enabled. The maintainer confirmed this extension is enabled starting with RHEL 9.8 and RHEL 10.2; exact affected builds and backports still need product assessment.
What input is required to exploit the issue?
The attacker must provide an OAuth2 JSON code field that is present but is not a string. The code can treat that field as successfully unpacked even though its resulting value is NULL, and a later strlen call crashes sssd_pam.
Does socket-boundary validation prevent the malformed input?
No. The incoming selection data is not sanitized at the PAM responder socket boundary.